ISMS training or ISMS awareness
This construct covers awareness training and policy compliance.
What the published 2016 guidance says
This construct covers awareness training and policy compliance. One measure is the share of staff who took the training against those who must take it; the other is the share who renewed it in the last year against the population in scope. Illustrative bands are green above 90 and 50, yellow above 60 and 30, and red below. Evidence is the participation list and the registry marked as received. It is collected monthly, analysed quarterly, reviewed annually. The HR training manager owns and collects it, and the security leads are clients. A colour-coded bar chart carries the result.
What it means in practice
Awareness training is a coverage measure with a renewal dimension. Count who received it and who renewed it in the period. The thresholds are illustrative; the useful discipline is the monthly collection and the named owner in HR.
Status of this record. For B.11, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the training register with the completion and renewal dates. Count against the population in scope. Report monthly to the training owner and quarterly to the ISMS. Record the follow-up for anyone overdue.
Evidence an assessor asks for
- Awareness and trainingTraining participation lists and registry entries
- Human resourcesIn-scope population from the employee database
- Awareness and trainingColour-coded bar graph with summary
The question an assessor will ask
An assessor will ask for training participation lists and registry entries. The test for B.11 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Denominator taken as headcount rather than those who must be trained
- Renewal never tracked, so I2 cannot be produced
Before the next review
Before the next review, test this against one live record: denominator taken as headcount rather than those who must be trained.
What to check when the revision publishes
When DIS 27004 is published, compare the B.11 ISMS training or ISMS awareness record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.